GHSA-jm35-h8q2-73mp

Suggest an improvement
Source
https://github.com/advisories/GHSA-jm35-h8q2-73mp
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/04/GHSA-jm35-h8q2-73mp/GHSA-jm35-h8q2-73mp.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-jm35-h8q2-73mp
Aliases
Published
2022-04-07T22:09:03Z
Modified
2024-11-30T05:32:45.534Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Improper one time password handling in devise-two-factor
Details

Impact

As a result of an incomplete fix for CVE-2015-7225, in versions of devise-two-factor prior to 4.0.2 it is possible to reuse a One-Time-Password (OTP) for one (and only one) immediately trailing interval.

Patches

This vulnerability has been patched in version 4.0.2 which was released on March 24th, 2022. Individuals using this package are strongly encouraged to upgrade as soon as possible.

Credit for discovery

Benoit Côté-Jodoin Michael Nipper - https://github.com/tinfoil/devise-two-factor/issues/106

Database specific 
{
    "nvd_published_at": "2022-04-11T20:15:00Z",
    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2022-04-07T22:09:03Z"
}
References

Affected packages

RubyGems / devise-two-factor

Package

Name
devise-two-factor
Purl
pkg:gem/devise-two-factor

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
4.0.2

Affected versions

1.*

1.0.0
1.0.1
1.0.2
1.1.0

2.*

2.0.0
2.0.1
2.1.0
2.2.0
2.2.1

3.*

3.0.0
3.0.1
3.0.2
3.0.3
3.1.0

4.*

4.0.0
4.0.1